Windows Legacy OS forum

General discussion

System Restore won't work

by austinhopeful / August 24, 2004 12:04 AM PDT

running windows XP home edition and somehow "my documents" ended up in the wrong place. While driving myself crazy tyring to fix it (I got it fixed) I thought I'd just system restore. I have restore points and it runs but at the end it says something like system restore failed. I've tried it on 4 different restore points and got the same results. I have Norton, spybot, and spywareblaster and have run all of them. I've also read all the posts about norton and system restore and don't feel that is the problem. I really don't need it now since I fixed my problem but I'd sure like to find out what the problem is. Is there any chance that the sp2 download could be causing this? I actually said yes to it on the 20th but so far I see nothing. Any other suggestions?


Post a reply
Discussion is locked
You are posting a reply to: System Restore won't work
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: System Restore won't work
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: System Restore won't work FOR ALL ISSUES.
by R. Proffitt Forum moderator / August 24, 2004 12:13 AM PDT

You bring up a good point. System Restore (SR) does not have anything to do with YOUR FILES. If you move your documents somewhere, SR will not put them back.

SR is to rollback the Operating System. Some don't know this. And it doesn't always work so this is why BACKUP is something we do.

Besides, hard disks are still temporary storage.


Collapse -
Re: System Restore won't work FOR ALL ISSUES.
by austinhopeful / August 24, 2004 12:30 AM PDT

hmmmm good point, I hadn't ever thought of that. I figured since "my documents" was part of the core system it would move them back where they belonged.

Collapse -
My Document are not part of the core system.
by R. Proffitt Forum moderator / August 24, 2004 1:18 AM PDT

They are part of your core system.

Think about it.


Collapse -
''Restore'' - what 'u should know.
by Cursorcowboy / August 24, 2004 1:46 AM PDT

1. The article [Q300044] states that by default, System Restore is enabled on all hard-disk partitions upon the completion of Windows XP Home Edition and Windows XP Professional Setup. However, after installation of the operating system, System Restore is automatically suspended when there is less than 200 megabytes (MB) of free hard-disk space on the system drive but will automatically resumes at the next system idle time when 200 MB is available. The same behavior is expected after installation if any of the partitions become low on available hard-disk space. Additionally, if disk-space use encroaches on the data store size, with non-monitored files for example, System Restore always yields its data store space to the system because the data store size is not a reserved space and is always calculated as effective size. For example, if the data store size is configured to 500 MB, of which 200 MB is already used and the current free hard-disk space is only 150 MB, the effective size is 350 MB (200 + 150), not 500 MB. In other words, the data store size is always limited by the available free hard-disk space.

Note: Ensure System Restore is up and running (Computer Management, right-clicking My Computer, and select Manage). You click the service and you can see if the srservice is set to automatic and if it is set to restart, or if it's stopped or disabled. You can also check via the command prompt by typing net start which give a list of all the services running. Also make sure System Restore is enabled on all the drives wanted (System Restore tab under the System Properties).

2. The article [Q309531] describes how to gain access to the System Volume Information folder that is a hidden system folder which the System Restore tool uses to store information and restore points and that exists for each hard-disk partition. This folder contains one or more _restore {GUID} folders such as _restore{87BD3667-3246-476B-923F-F86E30B3E7F8}. There may be one or more folders starting with RPx under this folder which are restore points. In addition, this articles explains that you can also use the command-line Cacls tool to display or modify file or folder access control lists (ACLs).

3. When starting System Restore and viewing the "Select a Restore Point" page (Click to see an example screenshot), some or all of the restore points may be missing and can be caused by any of the following by-design conditions, [Q301224]:

a. When it run out of disk space on the system drive (or on any of the available non-system drives), System Restore stops responding (hangs) and causes the system to purge all restore points in an attempt to free up disk space. However, a user should have already received a warning about running low in disk space prior to this point and when enough disk space was provided, System Restore starts to monitor the system again and recreated an automatic System Checkpoint. It is important to note that when multiple-partitions are used on a computer with a particular drive with little free space, that drive could cause System Restore to hang all across the system and delete restore points.

b. When System Restore has been turned off manually. You cannot shut down System Restore temporarily. If you use Control Panel to stop monitoring one or more drives, Windows deletes all saved restore points on the selected drive. If you re-enable System Restore monitoring, the deleted restore points are not re-created.

c. When upgrading from one operating system to another or reinstall Windows XP. After setup is complete and System Checkpoint is then run, previous restore points are gone. Windows does not allow rolling back to an older version of the operating system even if it's Windows XP to Windows XP using System Restore.

Note: An interesting article describing what happens when a computer is upgraded from either Win95 or Win98 to XP and then logon occurs for the first time, [Q300886]. Setup disables all of the program files (all .lnk and .exe files) by removing them from the Startup folder and the Run key in the registry, except for the "known good programs", which are not removed. If the Restore Startup Programs option is located on the Startup tab in the System Configuration Utility and it is available and selected, window opens and displays a list of all of the disabled programs, which includes their return locations (when they are enabled). This option enables a user to restore one or all of the files that are listed. If all of the programs listed are enabled, the next time the System Configuration Utility is started, all of the items are transferred to the Startup tab, and the Restore Startup Programs option is unavailable. This option is available only when one or both of the following conditions occurs:

(1) One or more values are identified and moved to the DisabledRunKeys registry key from the Run key (in the registry).

(2) One or more programs are identified and moved from the Startup folder to the two disabled Startup folders.

d. When starting the Disk Cleanup utility, clicking the More Options tab, and then clicking Clean up under System Restore, all restore points (except the most recent one) are purged.

e. When you are running low on disk space (but not to the point of causing the tool to hang), System Restore purges some of the restore points, but not all. This occurs because regardless of how much disk space you have, when the data store reaches approximately 90 percent of its maximum size (the default size or the user setting), System Restore uses a First In First Out (FIFO) process to decrease the size of the data store to approximately 75 percent of its maximum size.

f. When a restore point reaches an age of 90 days (the default time to live).

g. When manually reducing the data store size, it effectively triggers the FIFO process of some restore points to accommodate the newly-resized data store.

Note: By design, System Restore keeps a table on every drive. If you've set aside a drive exclusively for data, you can safely turn it off for that drive, which has the effect of not only reclaiming the space used but it also prevents System Restore from inadvertently wiping out any files.

5. The article [Q283096] states that when performing a restoration, an error message may be received similar to Restoration Incomplete:

Your computer cannot be restored to: (followed by an explanation)

Warning: When the computer is in safe mode, System Restore does not create restore points. Therefore, restoration to something changed in this state cannot be performed later. However, safe mode may be used to restore a computer to any restore point provided System Restore is not currently in a suspended state (insufficient disk space).

Note: When System Restore runs low on disk space, the monitoring of all drives is suspended. All drives are displayed as suspended in System Restore Status in Systems Properties in Control Panel.

Note: The article [Q304449] describes steps for starting System Restore from the Command Prompt when you are unable to start the computer normally or in Safe mode.

6. System Restore consists of two parts, File monitoring and Restore Point Management. It monitors file operations for a core set of system and application files specified in systemroot\System32\Restore\Filelist.xml. It records changes to the original file and sometimes copies it to a hidden archive before overwriting, deleting, or changing, the monitored file. It does not monitor the following files and folders, "Monitored File Extensions."

a. The virtual memory paging file:

b. Personal user data, such as files in My Documents, Favorites,Cookies, Recycle Bin, Temporary Internet Files (TIF), History, and Temp folders

c. Image and graphics files, including bitmap and JPEG files and files that use extensions commonly associated with data files, such as .doc, .xls, mdb, and.pdf.

d. E-mail managed by Outlook or OE.

7. System Restore points contain the following two types of information:

a. A snapshot of the registry.

b. Certain dynamic system files.

8. System Restore creates restore points according to the following system events, user actions, or time intervals:

a. Installing an unsigned device driver(s) - Windows will display a warning and if you choose to continue, the system creates a restore point before completing the installation.

b. Installing System Restore compliant applications using the Windows Installer, or Install Shield Pro version 7.0 or later.

c. Installing an update by using Automatic Updates.

d. Performing a System Restore operation by reverting to a previous state. It implements this safeguard in the event the wrong restore point is/was used. You can undo the last restore, rerun System Restore, and select another restore point.

e. Restoring data from backup media creates restore point restoring. If problems occur with the Backup application, and a system is left in an undetermined state, the system can be restored It does not revert personal data files copied to the computer by using the Backup tool.

f. Creating a restore point manually by initiating the use of the System Restore wizard. For example, before adding new hardware or software, manually create a restore point to record the current system state. If a problem occurs during or after the installation, the change(s) can be undone.

g. By default, System Restore creates restore points every 24 hours if you leave the computer turned on. If you shut down, the service creates a new restore point when it is started but only if the most recent restore point was more than 24 hours ago. Scheduled restore-point creation occurs when the computer is idle, when there is no mouse, keyboard, or disk activity.

h. Creating restore points at preset intervals is disabled by default but can be enabled by using the registry editor, Regedit.exe.


Note: Normally, System Restore automatically creates restore points every 24 hours. To adjust this interval, change the value RPGloballnterval from the 24 hours seconds default 86,400 by half (12 hours) 43,200, or adding an additional day (36 hours) 259,000. By default, System Restore deletes restore point after 90 days. To adjust this integral, change the value of RPLifeInterval from the 90 day default of 7,776,000 seconds to a value equal to 30 days, 2592,000 seconds.

9. System Restore archives expand to include multiple restore points, each representing unique system states. System state refers to the components that define the current state of the operating system and includes the following:

a. User account information stored in the registry.

b. Application, hardware, and software settings stored in the registry.

c. Files that Windows requires for startup, including those in the systemroot directory and boot files on the system partition, such as Ntldr or IA64ldr.efi.

Note: Archived restore point information is saved to a hidden system drive folder or an archive on the volume where a monitored file is located. The archive collects multiple restore points, each representing individual system states. The files, registry snapshots, and logs associated with older restore points are purged on a first in, first out (FIFO) basis, optimizing restore disk space and making room for new restore points. System Restore uses the following algorithms and conditions to determine whether it is time to purge restore point data:

(1) When it consumes at least 90 percent of allotted disk space, the 90 percent allotted is reduced to 75. (Space is limited to 12 percent of available disk space, which is not pre-allocated. Windows and applications can use the free portion of this space).

(2) When reducing the amount of disk space allotted (Using the Control Panel or the Disk Cleanup options) to System Restore caused it to purge all but the most recent restore points. For additional information see the helpful information concerning "Disk Cleanup".

(3) When System Restore is disable, all restore points are deleted.

10. System Restore can be configured to purge restore points by elapsed time. For example, you can specify deletion of restore points older than two months. By default, it purges restore points older than 90 days. To allocate disk space for archiving restore points:

a. Open "System Properties" (click to see an example screenshot), and select a drive (if there is only one drive or partition, it is already selected) from the Available drives box, and then click Settings.

b. In the Drive(drive: ) settings box, move the Disk space to use lever to select a new allocation. Caveat: Twelve percent is the maximum available disk space.

Warning The article [Q298915] warns that when trying to alter the percentage of the amount of disk space System Restore uses, some percentage numbers may be repeated or missing when moving the slider from Max to Min and occurs because the user interface allows specifying the disk percentage where it lines up on one of the "tick marks" on the size slider. Because numbers are rounded off, the tick marks might not line up close enough to a specific percentage number (depending on the size of your drive). There are 11 tick marks on the slider, but there are 12 whole number percentages that can be displayed (1 to 12), so one of them can be missing. Because of this, and depending on the size of the drive, some percentage numbers might be missing or might be repeated.

11. The article [Q310312] discusses how to remove all restore points except the most recent restore point using the Disk Cleanup Tool.

12. Examining the settings for the System Restore utility, it may be observed that System Restore is suspended even though enough free disk space actually exist on the system drive, [Q299904].

If a system is restored to a point in time before a Service Pack was installed, expect trouble.

a. For instance, if a Service Pack for Internet Explorer 6 had been installed, then it should be reinstalled as well as wanted Service Packs.

b. The article, "How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP (Q318378)" describes a procedure for editing the system registry to do so. Reinstall applicable Service Packs as you will.

c. When you install a service pack, you can save or reset restore points. If you choose the reset option, all existing restore points are lost and System Restore uses the new configuration as the baseline for future restore points.

d. What's Restored and What's Not:


Profiles (local only -- roaming user profiles not impacted by restore)
WFP.dll cache
IIS Metabase
Files with extensions listed in the "Monitored File Extensions" list. (click to see an example screenshot)

Not Restored

DRM settings
SAM hives (does not restore passwords)
WPA settings (Windows authentication information is not restored)
Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK
Any file with an extension not listed as (included) in the Monitored File Extensions list in the System Restore section of the Platform SDK
Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore)
User-created data stored in the user profile
Contents of redirected folders

e. You do not have to be a rocket scientist to appreciate the potential of time travel when dealing with System Restore. Anything from new accounts, computer or workgroup names or domain membership (you may be warned), and programs installed are lost -- does not uninstall programs, although it does remove executable files and DLLs. To avoid orphan programs and shortcuts, make notes or remember these things before doing a roll back. Otherwise, uninstall first. Although you can restore from Safe Mode, you cannot undo a restore operation.

13. When using MSCONFIG and you clear the Load System Services check box on the General tab, Windows will permanently deletes all restore points for the System Restore utility. Do not do this if you want to retain your restore points for System Restore or if you must use a Microsoft service to test a problem, [Paragraph 5, Q310353].

14. The article [Q307852] discusses the Last Known Good Configuration feature, a recovery option used to start a system by using the most recent settings that worked and restores registry information and driver settings that were in effect the last time the computer started successfully. The Last Known Good Configuration feature should be used when the system cannot be started after having make changes that bomb or when you suspect that a change made causes a problem. For example, this feature could be used to start the computer after installing new drivers which don't work or incorrect driver and the system has not already been restarted. When a system is started using the Last Known Good Configuration, the information in the following registry key is recovered:


Note: The Last Known Good and System Restore features provide a compliment of functionality to assist a user in recapturing a machine in a non-bootable state. When the system detects a failed boot attempt, it will automatically select the Last Known Good option from the F8 menu which a users can also elect to use. Using the Last Known Good, users can usually boot into either the Safe or Protect (Normal) mode. However, if users want to revert undesired changes to the system to recapture previous state, System Restore is used. "IOW", Last Known Good Configuration should be used when there is a non-bootable state. Once booted into either Safe Mode or Normal Mode, System Restore can be used to capture optimal previous state. System Restore cannot be accessed unless the system is bootable into either Normal or Safe mode.

15. The article [Q306546] discusses how to use the Driver Roll Back Feature to restore a previous version of a device driver, and to restores any driver settings that were changed when new drivers were added. However, please note that printer drivers cannot be rolled by.

Note: Please also read the TechNet article, "How to Roll Back a Device Driver."

Warning: System Restore with its active change monitoring design captures all monitored file and registry changes made by installing a new device driver but when a driver doesn?t work a user should merely reinstall the previous driver -- or one that worked, and continue operation. Since driver installation is only a subset of the overall system state, it should be noted that using System Restore to revert undesirable changes to the system resulting from driver installations, it will also revert any other changes to the system made since the last restore points created -- created automatically when a driver is installed. "IOW", anything between the previously created restore points and this one will be lost, and could be anything from changes to desktop appearance, dial-up networking settings, or just about anything forgotten about.

16. When an in-place upgrade is performed, all existing restore points are removed and a new System Checkpoint restore point is created after the in-place upgrade is complete.

Warning: Do not perform an in-place upgrade if it is necessary to roll back a system to a previous state, [Q301224]. In addition, your system may lose data or program settings, [Q312369].

17. Backup copies of registry files (either from the first time Windows was started or the last time the Backup utility was used to perform a System State backup) are stored in the %systemroot%\Repair folder and are replaced after an in-place upgrade is complete.

Warning: If backups may be needed to restore the system after an in-place upgrade is completed, they must be copied to another location before the upgrade is accomplished, [Q315341].

18. Supplemental reading to include their related links:

a. "SR Calendar Is Not Updated Properly if You Modify System Clock Date While SR Interface Is Still Open (Q281779)."

b. "System Restore Points Time and Date Change (Q282814)."

c. "How to Use the System Restore Utility with Windows Management Instrumentation (Q295299)."

d. "The Registry Keys and Values for the System Restore Utility (Q295659)."

e. "A Description of the "Restore Startup Programs" Option That Is Used When You Upgrade to Windows XP (Q300886)."

f. "Troubleshooting System Restore in Windows XP (Q302796)" and it's internal eight references.

g. "Cannot Start Windows XP if the System or Software Hive Is Missing or Damaged (Q303012)."

h. "Restore Point Creation Takes Up to 10 Minutes if the WMI Service Is Not Running (Q305992)."

i. "Restore Windows XP to a Previous State (Q306084)."

j. "System Restore Tool Displays a Blank Calendar in Windows XP (Q313853)."

k. "A Description of the Safe Boot Mode Options in Windows XP (Q315222)."

l. "You Cannot Create a Network Connection After You Restore Windows XP (Q329441)."

Note: This issue may occur if the manufacturer's drivers for a HighPoint RAID controller type HPT370, HPT370A, or HPT372 are installed. This issue may occur with driver revisions 2.30 and 2.31, which are not digitally signed.

Popular Forums
Computer Help 49,613 discussions
Computer Newbies 10,349 discussions
Laptops 19,436 discussions
Security 30,426 discussions
TVs & Home Theaters 20,308 discussions
Windows 10 360 discussions
Phones 15,802 discussions
Windows 7 7,351 discussions
Networking & Wireless 14,641 discussions

CNET Holiday Gift Guide

Looking for great gifts under $100?

Trendy tech gifts don't require a hefty price tag. Choose from these CNET-recommended useful and high-quality gadgets.